Add a new TestClass that verifies test permissions change on charm up…

zaza/openstack/charm_tests/ceph/mon/tests.py

@@ -15,6 +15,7 @@
 """Ceph-mon Testing for cinder-ceph."""
 
 import logging
+import os
 
 import zaza.model
 
@@ -125,6 +126,30 @@ def test_500_ceph_alternatives_cleanup(self):
         logging.info("... Done.")
 
 
+class CephPermissionUpgradeTest(test_utils.OpenStackBaseTest):
+    """Verify that the ceph mon units update permissions on upgrade."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Run class setup for running ceph mon tests."""
+        super().setUpClass()
+
+    def test_ceph_permission_upgrade(self):
+        """Check that the charm updates permissions on charm upgrade."""
+        # Revoke 'osd blocklist' command
+        zaza.model.run_on_leader(
+            'ceph-mon',
+            'sudo -u ceph ceph auth caps client.cinder-ceph mon '
+            '"allow r; allow command \"osd blacklist\"" osd "allow rwx"')
+        charm = 'ceph-mon'
+        charm_path = os.getcwd() + '/' + charm + '.charm'
+        logging.debug("Upgrading {} to {}".format(charm, charm_path))
+        zaza.model.upgrade_charm(charm, path=charm_path)
+        auth = zaza.model.run_on_leader(
+            'ceph-mon', 'ceph auth get client.cinder-ceph')['Stdout']
+        self.assertIn('blocklist', auth)
+
+
 def does_relation_exist(unit_name,
                         application_name,
                         remote_application_name,